hello {{username}}
<script>alert(1);</script>